Proceedings of the Standing Senate Committee on
Banking, Trade and Commerce
Issue No. 46 - Evidence - October 25, 2018
OTTAWA, Thursday, October 25, 2018
The Standing Senate Committee on Banking, Trade and Commerce met this day at 10:31 a.m. to examine and report on issues pertaining to the management of systemic risk in the financial system, domestically and internationally.
Senator Douglas Black (Chair) in the chair.
[English]
The Chair: Good morning and welcome, colleagues, and members of the general public who are following today’s proceedings of the Standing Senate Committee on Banking, Trade and Commerce either here in the room or listening via the web.
My name is Doug Black. I chair this committee. I’m a senator from Alberta. I ask that colleagues introduce themselves to you.
Senator Wallin: Pamela Wallin, Saskatchewan.
Senator C. Deacon: Colin Deacon, Nova Scotia.
Senator Campbell: Larry Campbell from British Columbia, and I’m subbing for Senator Ringuette.
Senator Tannas: Scott Tannas, Alberta.
Senator Wetston: Howard Wetston, Ontario.
Senator Tkachuk: David Tkachuk, Saskatchewan.
The Chair: I know a number of you have appeared us before. You’re well aware that our clerk and our analysts do very good work for this committee.
On October 17, 2017, the Standing Senate Committee on Banking, Trade and Commerce was authorized to conduct a study on issues pertaining to the management of systemic risk in the financial system, domestically and internationally. Given that it has been 10 years since the global financial crisis, the committee is interested in learning about the measures that have been implemented since that time to manage systemic risk in the financial sector and the efficiency of these measures. We are also interested, of course, in other systemic risks that you may identify and may want to draw to our attention.
Today is our second meeting on this subject. It gives me great pleasure to welcome the following witnesses: From the Bank of Canada, Ron Morrow, Managing Director, Financial Stability Department; from the Department of Finance Canada, Leah Anderson, Assistant Deputy Minister, Financial Sector Policy Branch; from the Office of the Superintendent of Financial Institutions Canada, Jeremy Rudin, Superintendent; from Canada Mortgage and Housing Corporation, Steven Mennill, Chief Risk Officer; and from Canada Deposit Insurance Corporation, Dean Cosman, President and Chief Executive Officer.
We have a tremendous panel. We have much ground to cover so we will get under way. I have a speaking list that I understand you have all agreed to. We start please with the Department of Finance Canada.
Leah Anderson, Assistant Deputy Minister, Financial Sector Policy Branch, Department of Finance Canada: I’m Leah Anderson. I’m the Assistant Deputy Minister of the Financial Sector Policy Branch at the Department of Finance. I very much appreciate the opportunity to speak with the committee today on the management of systemic risk in the financial system, both internationally and domestically.
To begin, what is systemic risk? Systemic risk is a disruption of the provision of financial services, like deposit taking, the provision of credit or the extension of payment transactions caused by an impairment of all or parts the financial system and has the potential to have serious negative consequences for the economy.
The global financial crisis revealed that the international financial system was vulnerable to systemic risks. It began in 2007, with a crisis in the sub-prime mortgage market in the United States. It became clear the world’s largest banks were interconnected and exposed to increasingly complex and opaque markets and had engaged in excessive risk taking.
The crisis accelerated with the collapse of the investment bank Lehman Brothers in 2008. Internationally, jurisdictions took extraordinary measures to prevent a global collapse of the financial system, including bank bailouts in some jurisdictions.
The strength of Canada’s approach to financial sector oversight allowed us to better weather the global financial crisis than others. Not a single bank in Canada failed during the crisis. There were no bank bailouts. Canada consistently ranks among the soundest financial systems internationally.
[Translation]
The crisis highlighted the need for international regulatory action and coordination due to the complexity and global integration of the financial system. It also identified areas where Canadian authorities could further strengthen our sound framework.
[English]
Complacency is not an option, given the rapid evolution and complexity of the financial sector.
The G20 created the Financial Stability Board, otherwise known as the FSB, post-crisis to coordinate the development and to monitor the implementation of a comprehensive program of financial reforms to increase the resilience of the financial system.
The reform agenda has four core areas. I will speak briefly about each in turn, with examples of some important related responsive actions undertaken by Canada. My colleagues joining me today from the financial sector agencies may expand on some of these actions in their remarks and in response to questions later from this committee.
First, building resilient financial institutions. This first pillar seeks to make banks and other financial institutions more resilient to financial or operational shocks, including applying higher and better-targeted capital and liquidity requirements through the Basel III standards. Canada is compliant in its implementation of these standards and is recognized as putting in place more rigorous requirements than the international baseline.
Second, ending “too big to fail.” This pillar seeks to end reliance on taxpayer support and facilitate ex ante planning to keep the critical services that systemically important financial institutions provide to the financial system operating during a crisis. Reforms include identifying systemically important financial institutions, applying additional supervisory and capital requirements, and implementing cross-border recovery and resolution plans so even the failure of the largest financial institutions can be managed in an orderly manner while ensuring the continuity of critical services.
In this domain, Canada has implemented a number of related measures. For example, Canada’s largest banks, which have been designated as domestically systemically important, must have resolution plans. In addition, a “bail-in” regime has been implemented as an important new tool for resolving these banks. In contrast to a bailout, a bail-in is intended to resolve a failing bank by making its creditors and shareholders, not taxpayers, bear the cost of recapitalizing the bank through the conversion of some of the bank’s debt into common shares.
The third pillar is making derivatives markets safer. The crisis demonstrated the potential for contagion arising from the interconnectedness of market participants and the limited transparency surrounding counterparty relationships. In response, global over-the-counter OTC derivatives reforms were developed to reduce counterparty risk and thereby the risk of contagion and increased transparency, making the derivatives market more resilient.
Implementing the OTC derivatives reforms in Canada involves co-operation between the federal and provincial authorities. Canadian banks are expected to centrally clear standardized OTC derivatives trades and are subject to higher capital and minimum margin requirements for all non-centrally cleared derivatives and are required to report transactions to a trade repository.
The fourth pillar is enhancing resilience of non-bank financial intermediation. Regulatory reforms under this pillar, which are largely led by our provincial partners, aim to strengthen the oversight of non-bank financial intermediation through the development of monitoring mechanisms to identify and address any emerging risks. By making the financial system more resilient and thereby reducing the likelihood and severity of future crises, the reforms I described aim to reduce the public costs and losses in employment associated with such crises.
[Translation]
Global coordination and cooperation has been very effective. Global implementation of the reforms is well under way.
[English]
Global implementation of the reforms is well under way. The FSB continues to support the full, timely and consistent implementation of these reforms across jurisdictions.
[Translation]
Canada also has very effective domestic coordination mechanisms for monitoring and managing systemic risks.
[English]
The Minister of Finance is ultimately responsible for financial stability and is well supported by the federal agencies represented at this table, which has clear and distinct mandates that contribute to financial stability.
We work closely together. We have what is called the Senior Advisory Committee, which promotes collaboration and information sharing among the agencies in order to provide policy advice to the Minister of Finance on vulnerabilities and risks related to the financial sector and financial stability.
This committee has, for example, guided our collective efforts to take gradual and coordinated steps to manage housing-related financial system vulnerabilities. There are also important coordination mechanisms with provincial authorities. For example, the Heads of Agencies Committee provides a forum for federal financial sector authorities and provincial securities regulators to exchange information and views on issues of mutual interest related to Canadian capital markets.
The Government of Canada also continues to work with participating provinces and territories to establish a Cooperative Capital Markets Regulatory System, which would better protect investors, foster efficiency and innovation, and strengthen Canada’s capacity to identify and manage systemic risk in capital markets on a national basis.
[Translation]
In conclusion, post-crisis reforms have contributed to a stronger global financial system.
[English]
In Canada, the implementation of the post-crisis reforms has further strengthened Canada’s regulatory system.
I would like to thank the committee for its attention to the important issue of financial sector resilience. That concludes my remarks.
The Chair: Thank you very much, Ms. Anderson.
May we hear, please, from Mr. Morrow, from the Bank of Canada.
Ron Morrow, Managing Director, Financial Stability Department, Bank of Canada: Good morning, Mr. Chair and committee members. Thank you for the invitation to speak today on this important topic.
My remarks today will centre around two themes. The first is in the wake of the global financial crisis, much has been done to improve the resilience of the Canadian and global financial systems. My colleague Leah from the Department of Finance has already noted many initiatives that have been undertaken. As such, I will limit my remarks to actions taken by the Bank of Canada within the scope of our mandate and role.
My second theme is that although the resilience of the system has been strengthened, we cannot be complacent. To set the stage, let me start with a brief description of the role the Bank of Canada plays in the Canadian financial system.
Our mandate is to foster a stable and efficient system. We do this by providing central banking services, which include managing liquidity and “lender of last resort” facilities; overseeing key Canadian financial market infrastructures, or FMIs; conducting and publishing analysis and research; and helping to develop and implement financial sector policy in conjunction with other government agencies.
Over the past several years, the bank has updated the policies that support our financial market operations to reflect some of the lessons learned during the crisis. These updated policies have enhanced our ability to effectively undertake our routine, day-to-day market operations. More importantly, though, these policies guide the bank’s response to extraordinary or emergency liquidity needs. They set out a framework that describes the range of tools the bank could use to deal with severe, systemwide liquidity stress.
The bank has revised its Emergency Lending Assistance, or ELA, policy to clarify the role that ELA can play as a temporary source of liquidity to support the recovery or resolution of eligible financial institutions and FMIs. At the same time, the bank expanded the list of eligible collateral for ELA loans to include mortgages, significantly increasing the capacity of eligible institutions to borrow under ELA.
Finally, the bank provided greater clarity for the eligibility criteria and conditions under which FMIs and provincially regulated deposit-taking institutions can access ELA.
In addition to updating our market operations and liquidity framework, a number of initiatives have been undertaken to improve the risk management practices of FMIs and further strengthen the stability of our financial system. FMIs, such as Canada’s wholesale payment system, the large-value transfer system, act as a hub for financial transactions and serve as the backbone of the financial system. FMIs facilitate the safe and efficient exchange of funds, securities and other financial products by connecting financial institutions and market participants with one another.
Today I will draw attention to two initiatives undertaken to improve the resilience of FMIs.
First, the bank has worked with other countries to develop a global set of principles to ensure the various risks faced by FMIs — including credit, liquidity and operational risk — are prudently managed. The bank has also incorporated these principles into its risk management standards for Canadian FMIs.
Second, the bank has worked with federal and provincial authorities to develop a resolution regime for FMIs. This regime addresses the extremely unlikely circumstance where an FMI experiences losses so severe it is unable to continue to provide its critical functions. The new regime will allow the bank and other authorities to allocate losses and restore the critical services provided by the FMI.
[Translation]
Now, let me turn to my second theme — the need to remain vigilant. Threats to the financial system are continuously evolving, and new threats can arise as technology and business practices change. As such, we need to be looking for potential new vulnerabilities, assessing the evolving resilience of the financial system and communicating this work through means such as the bank’s Financial System Review (FSR).
In our June FSR, we noted that elevated household indebtedness and housing market imbalances remain key vulnerabilities. We also highlighted cyber vulnerabilities, which are garnering significant attention from both financialinstitutions and government agencies. By publishing our vulnerability assessment work in the FSR, we’re able to draw attention to these important issues. More importantly, this work also helps us to engage with private and public-sector institutions and explore different policies and actions that can be taken to mitigate the vulnerabilities.
Thank you for your attention. I’d be happy to answer your questions.
[English]
The Chair: Thank you very much, Mr. Morrow. I’m sure there will be questions.
Mr. Rudin, please, from OSFI.
Jeremy Rudin, Superintendent, Office of the Superintendent of Financial Institutions Canada: Thank you, Mr. Chair. It’s currently my privilege to serve as the Superintendent of Financial Institutions. I will speak today from that perspective.
Our organization is charged with supporting the safety and soundness of banks and federally regulated insurance companies. We do that through the regulation and supervision of those institutions.
As you know, it is now 10 years since the failure of Lehman Brothers ushered in what has come to be called the global financial crisis. It is widely accepted Canada and the Canadian financial system performed very well during that period, particularly when compared to events in the United States and in many European countries.
This relatively strong performance raised an important question for the Canadian financial system broadly and for our organization in particular: Should we simply keep doing what we had been doing because it appeared to have worked well? Or should we make changes in light of the enormity of the global crisis? The correct answer, in my view, is both of these things.
Parliament created OSFI in 1987 with a view to creating a regulator and supervisor that would be proactive and that would, in the expression of the day, have the will to act. Over the 20 years that led up to the global financial crisis, OFSI indeed demonstrated that willingness. Part of Canada’s relatively strong performance during the crisis was due to the fact that my predecessors at OSFI had put in place a regulatory and supervisory approach that continued to evolve and went beyond international norms when necessary.
[Translation]
Canada’s relatively good performance during the crisis could have led to some complacency at OSFI. After all, the Canadian financial system had weathered a near-perfect storm. Fortunately, in my view, OSFI drew the opposite conclusion. Drawing the lessons from the experience in other countries, and at home, OSFI embarked on a wide-ranging strengthening of both regulation and supervision.
[English]
In banking, the centrepiece of the changes that we made after the crisis were the regulations governing banks’ capacity to absorb losses, which are known as capital requirements. This we did in concert with our international colleagues. We also implemented new regulations for banks’ liquidity, which is the banks’ ability to meet their financial obligations as they come due. This was also done in concert with our international colleagues. We developed new guidance on model risk in banking, which is the risk that can arise from the faulty design, development or use of a mathematical model, and more recently for residential mortgage underwriting.
In insurance we now have revised capital requirements specifically tailored to the three main types of insurance companies, life and health insurers, property and casualty insurers, and mortgage insurers. Covering both the banking and insurance industries, we have new guidelines on stress testing and also on operational risk, which is the risk of loss resulting from human errors, poor internal processes or from external disruptions.
Of course, there is a danger that all of this activity will lead to regulations that are too numerous, or that work at cross-purposes. For example, over the past few years, a number of people who have served on the boards of directors of the institutions we supervise have told us that our requirements for boards of directors were too detailed, too prescriptive and, frankly, too burdensome. We heard that feedback and it led us to review the requirements we placed on boards across all of our various guidelines and through our supervisory letters. We found a long and in some ways less-than-consistent list of tasks for boards to navigate. That is in the past. We have now revised our corporate governance guideline, consolidating all of our expectations for boards in one principles-based guideline that serves as a one-stop shop for boards.
[Translation]
Let’s return to the question that arose after the crisis: Should we keep doing what we were doing or should we change? In fact, there was no conflict between these two options.
[English]
What we were doing before the crisis was working hard to keep our regulation and supervision up to date based on our own experience and experience in other countries. That is what we continued to do in the wake of the crisis.
[Translation]
And that is what we will continue in the future. Thank you.
[English]
The Chair: Thank you very much.
We will now hear from the Canada Deposit Insurance Corporation, Dean Cosman.
Dean Cosman, President and Chief Executive Officer, Canada Deposit Insurance Corporation: Thank you, Mr. Chair.
[Translation]
Thank you for the opportunity to address you.
[English]
By way of background, CDIC is Canada’s deposit insurer and resolution authority. We protect Canadians’ savings at banks, federal credit unions as well as federal trust and loan companies. As resolution authority it is our role to resolve these financial institutions should they fail. In fact, since 1967 we have handled 43 failures affecting some 2 million Canadians and approximately $26 billion in deposits. I am happy to note no depositor insured by CDIC has lost a single dollar. CDIC also plays an important role in promoting and contributing to the stability of the financial system in Canada. In doing so, we work closely with the organizations represented by my colleagues with me today. We work together to strengthen financial stability in Canada.
Following the financial crisis, the Financial Stability Board developed a set of key attributes that countries should have in place to resolve large complex banks. These were endorsed by Canada along with other G20 countries. The objective of these attributes is to end “too big to fail” by making it possible for authorities to resolve large, complex banks in a manner that maintains the flow of critical financial resources, protects the economy and minimizes the exposure to taxpayers. Through the work with our safety net partners as well as domestic and international stakeholders I am pleased to report CDIC substantially meets all of the key attributes.
Since the financial crisis, CDIC’s objects have been amended to formally recognize our role as resolution authority for all of our member institutions including Canada’s largest banks. CDIC’s powers have been expanded, our capacity has grown and our capabilities have been augmented. As a result, we are better prepared to deal with the failure of any of our member institutions including Canada’s domestic systemically important banks, or D-SIBs.
I’ll briefly explain a couple of examples of how our capabilities have been augmented. First, on the heels of the crisis, in 2009, the bridge bank power was added to CDIC’s resolution tool kit. It is meant to bridge the gap between when an institution fails and when a buyer or private sector solution can be found. CDIC can use this tool to transfer all or part of the failing bank’s business to a bridge bank that is temporarily owned by CDIC. Since the crisis, we have also continued to grow our ex ante funding, and our borrowing capacity has been expanded. More recently, CDIC was granted the bail-in power to take control and recapitalize a large bank through a conversion of certain eligible liabilities into common equity. This ensures losses related to large bank failure are borne by the bank’s shareholders and certain creditors and not depositors or taxpayers. CDIC requires each of Canada’s six D-SIBs to prepare resolution plans. These plans set out in detail how they might be resolved. CDIC has been working closely and collaboratively with these banks over several years to ensure these plans are robust and credible. A bylaw formalizing this process and CDIC’s expectations as to resolvability is also in progress and will be published soon.
The plans are important but they must be tested. We have developed a robust testing program to assess our own internal readiness. The program also includes testing exercises by the board of directors, other safety net partners, D-SIBs and other stakeholders. Canada’s large banks are international. Co-operation and coordination with international regulators on cross-border issues has also been a key piece to our resolution work. To better position us, CDIC has signed co-operation agreements and MOUs with all key international jurisdictions.
To further our international co-operation, in concert with OSFI, we host annual crisis management groups. These bring together the D-SIBs, Canada’s safety net agencies as well as regulators from key international jurisdictions to discuss recovery and resolution planning for Canada’s D-SIBs.
We have learned financial stability is built on public confidence. Our research on depositor behaviour has shown if Canadians are not aware that deposit insurance exists and that their deposits are protected, in a crisis they are more likely to behave as if there is no deposit protection at all and precipitate a bank run. This is why we have a public awareness strategy to inform Canadians about CDIC deposit protection.
Let me conclude by saying that as a deposit insurer and resolution authority our role is to manage failures, not to prevent them, so that depositors are protected, critical financial services are not interrupted and the disruption to the broader economy is held to a minimum. In the 10 years since the crisis much has been done to better position us. However, we cannot lose focus. The financial sector landscape and Canadians’ habits and expectations are in constant evolution. The next financial crisis may look very different from the last one. We must continue our efforts to strengthen our resolution framework and our preparedness to ensure we can adapt and be ready for any new risks and challenges. Regardless, at CDIC our commitment remains to safeguard the savings of Canadians. Thank you.
The Chair: Thanks very much, Mr. Cosman.
Our last witness is from Canada Mortgage and Housing Corporation, Steven Mennill, Chief Risk Officer.
Steven Mennill, Chief Risk Officer, Canada Mortgage and Housing Corporation: Thank you, Mr. Chair. It’s a pleasure to be here on behalf of Canada Mortgage and Housing Corporation.
[Translation]
CMHC helps Canadians meet their housing needs. We understand that housing is about more than just shelter: it is the foundation for strong, inclusive communities and sustainable economic growth.
Our formal mandate to contribute to financial stability arose from the global financial crisis of 2008-09. But, in fact, CMHC’s mortgage loan insurance and securitization activities have long been important features of Canada’s housing finance system. These programs are operated on a commercial basis at no cost to the Canadian taxpayer, and make CMHC a systemically important financial institution in Canada.
[English]
My colleagues have spoken about the measures taken by governments over the past decade to stabilize the financial system. CMHC played a central role in implementing a number of these measures. Going back to the financial crisis, our stabilizing presence has been cited by several economists as a key reason why Canada was able to weather the credit and liquidity problems that destabilized other major economies.
We emerged sooner and stronger than other countries, in part because of the actions we took to stabilize the housing finance system and, in turn, housing markets.
Through the Insured Mortgage Purchase Program, CMHC insured, securitized and purchased almost $70 billion in mortgages from Canadian financial institutions, giving them access to long-term funds for lending to consumers, homebuyers and businesses. We were able to get this program up and running very quickly thanks in large part to our existing insurance and securitization products, infrastructure, commercial relationships, systems and staff expertise. This was done without the need for fundamental changes to government policy or significant new legislation.
We also scaled up our mortgage insurance operations during this time when private sector competitors retreated and lenders sought the security of the government guarantee of CMHC’s mortgage insurance. As a result, eligible Canadian homebuyers and investors in rental housing had uninterrupted access to mortgage financing even while credit was drying up elsewhere.
Emerging from the crisis, CMHC’s share of the mortgage loan insurance market was close to 90 per cent. Our insurance in force was approaching the $600 billion limit. Lenders usage of our securitization program was growing rapidly. After this heavy but appropriate and necessary government intervention during the crisis, there was a need to normalize the system, to reduce taxpayer exposure to housing and mortgage markets. In the decade that followed the crisis, we have returned to those pre-2008 levels without shocking the system, while retaining the ability, if needed, to respond again.
Our role is to help Canadians meet their housing needs, not their wants. This led to the elimination of programs that do not need government support, such as mortgage insurance for condominium construction and insurance for second homes. We also increased the pricing of our mortgage insurance products and have adopted a much more sophisticated capital management regime that will help us manage through future crises.
As part of this natural evolution, mortgage insurance for multi-unit properties, rental properties, has become an increasingly important part of our business. We recently relaunched our rental insurance products to better support the creation of affordable rental housing. This is a key goal of Canada’s National Housing Strategy that is being led by CMHC.
On the securitization side of our business, we have increased fees and introduced limits to the amount of funding we make available to individual financial institutions. We developed and now oversee a covered bond legal framework introduced by the federal government that helps lenders diversify their funding base.
Although CMHC has significantly reduced both our insurance in force and guarantees in force under the securitization programs, we are aware of the critical mass needed to quickly expand our presence should the need arise. As a Crown corporation, we need to be present in the market through all economic cycles. This is a fundamental way in which we contribute to financial stability.
Another change worth noting is CMHC is now overseen by OSFI. Guidance from OSFI, together with systemwide improvements in regulatory capital rules and our own commitment to be a leader in housing risk management, have helped de-risk both CMHC and the housing finance system.
Like all financial institutions, we stress test our business. As a publicly funded Crown corporation, we publicly share these results. Our latest stress test results were released earlier this month and confirmed CMHC has sufficient capital to weather severe and extremely unlikely scenarios, including sustained low oil prices, a global trade war, a cyberattack on the financial system or a major natural disaster.
In other words, we can be counted on and stand ready to support the housing finance system and contribute to financial stability again if needed. Thank you.
The Chair: Thank you very much. To all the panellists, those were tremendous presentations. Thanks a lot. We have a number of questioners. We’re going to start with Senator Wetston to be followed by Senator Wallin.
Senator Wetston: I have been looking for an opportunity to ask this question. I’m going to ask Ms. Anderson. I appreciate you noting this in your materials.
The Government of Canada continues to work with participating provinces and territories to establish the Cooperative Capital Markets Regulatory System. Can you elaborate on what that is and what your expectations are for that? I’m not sure whether the committee has heard much about this Cooperative Capital Markets Regulatory System known by another name that I probably won’t use here.
Ms. Anderson: Thank you, senator, for the question. The objective of the initiative is threefold. First, to increase efficiency in the oversight of capital markets. Currently we have securities regulators across our various jurisdictions. This would have them work cooperatively together to have more efficient and effective oversight of the markets in which they regulate.
Second, it would strengthen enforcement of securities fraud and crime. It would have the ability to detect, identify, monitor and take enforcement action against crime, such as insider trading, market manipulation, and have new authorities to deal with the enforcement of those crimes and address them.
Lastly, on the systemic risk front, a very important facet of the program and to what we’re speaking about in this committee today, it would provide new authorities to get greater line of sight into the systemic risk in the economy and the ability to mitigate those. It would give powers to have data collection across a range of financial services and products, as well as the authority to take actions to mitigate those risks where systemic risk is identified.
Senator Wetston: I think there could be a lot of questions here. For the benefit of the committee, I’ll just move on and potentially have a second round.
The Chair: You can have a tight follow-up question now, Senator Wetston.
Senator Wetston: What’s important here is to identify the commitment of the federal government and certain provinces to the development of this system. I’m wondering if you could elaborate on who is participating and what the status of it is and what your expectations might be for this Cooperative Capital Markets Regulatory System to come into being. I recognize there is a case in the Supreme Court of Canada, a Quebec reference, which probably puts some brakes on the progress. I think it would be helpful because I don’t think we’ve had an opportunity to speak about this in this committee, at least recently. Would you be able to clarify that a bit?
Ms. Anderson: Yes. We have a number of participating jurisdictions in the initiative. We have been working closely together on those fronts in developing the common cooperative markets act to the point of increasing the efficiency of the various administrations of the regime. I think we’re making good progress with those provinces.
In light of the securities reference and the court case, we will need to take stock after the decision is delivered.
Senator Wetston: You’re waiting for the decision of the Supreme Court?
Ms. Anderson: Correct.
Senator Wetston: Canada’s role in the international framework dealing with systemic risk, Mr. Rudin, I wonder if you could elaborate more on what that role has been and how you see that role continuing to evolve. I think it’s important for this committee to understand how involved officials have been with respect to the standards being developed by the Financial Stability Board. Are you able to elaborate on that?
Mr. Rudin: Thank you. I would be happy to give you a few examples. I suppose the highest profile example is when Mark Carney was the Governor of the Bank of Canada, and he took on the responsibility as chair of the Financial Stability Board, which is, of course, the key role. He kept that role when he became Governor of the Bank of England.
My predecessor, Superintendent Julie Dixon, played a very important role leading the post-crisis work on supervisory intensity and effectiveness, which was an attempt to bring supervisors together to learn from each other and to correct some of the lapses that had taken place, more in other countries than in Canada, in terms of a lack of supervisory intensity.
I think there are a number of us at all of these organizations who are represented in various initiatives. I recently concluded leading a working group of the Financial Stability Board on governance and mitigating the risk of misconduct. I know that Ron was very active on the Basel committee that worked on the treatment of sovereign debt. CDIC has been very involved in turning the International Association of Deposit Insurers into an effective standard-setting organization. The list goes on.
I think even more important than the individual contributions is the way we have approached implementation. At the Financial Stability Board, we do an annual report to G20 leaders. Included in that is a report card, essentially, on the implementation of the initiatives Ms. Anderson listed for us country by country, with either a green, yellow or red. It’s a real exercise in transparency and accountability that you might not expect from an international organization.
We would be happy to provide you with the most recent version, which was prepared last summer. There will be a new version shortly for leaders ahead of the summit in Buenos Aires. You will see Canada is amongst the leaders in implementation. I think that’s very important both because you lead by example, but also because we recognize the interconnectedness of the global financial system in developing a reputation as regulators and supervisors who can be counted on to do what they say they’re going to do. I think that can be very valuable on the go forward.
The Chair: I’m glad you asked that question. Thank you.
Senator Wetston: Thank you, chair. I’m pleased you allowed me to ask it.
Senator Wallin: I think the governor said, in the last 24 hours, the rate hike of 0.25 per cent is still stimulative. If the rate hike is doing its job, it implies, more or less, that the government doesn’t need to be spending or accumulating debt if the monetary policy is doing its job.
Can you please comment on that?
Then, if the bank’s intent is to get the rate to a level which is no longer stimulative, how long will that take, and what’s the plan? We’ll go to the Bank of Canada.
Mr. Morrow: Thank you very much for the question. As outlined in our Monetary Policy Report yesterday, the press release and the report itself noted the Governor-in-Council is of the view it is on the path to taking rates to a more neutral level in Canada. Our research shows that number is somewhere between 2.5 and 3.5 per cent. The pace at which we get there is going to be informed by news, macroeconomic developments and how the economy responds to those rate changes. Beyond that, I believe the governor and the senior deputy governor will be here in about six days and will be able to offer more insight for you.
Senator Wallin: I know we’re talking about systemic risk, but I think this falls into the category. The banks say the price differential on the discounted price of oil in this country means we’re leaving a minimum of $15 billion on the table. At some point, if we continue and that system doesn’t change, we can’t move it or sell it at a price it should be at. That’s going to present risk.
Mr. Morrow: It’s certainly a source of macro risk to the economy. It reflects the challenge of infrastructure to transport energy. Again, I don’t think it serves as a source of systemic financial risk to the financial system. It is an important part of the broader macro backdrop to the Canadian economy.
Senator Wallin: Unless we don’t do something about it.
Mr. Morrow: We’ll look to others to sort out how to deal with that.
Senator Wallin: I think the deputy governor said while personal debt levels are high, the quality of the debt is better. Can you explain?
Mr. Morrow: Certainly. As my colleagues have noted, there have been a number of actions taken by both the federal government and OSFI to tighten underwriting regulations for mortgages. As a result, if we look at the number of mortgages being provided to highly indebted households — defined as those with a debt-to-income ratio of more than 450 per cent — before the policy changes, the proportion of those had been rising up to about one fifth of all mortgages. Those numbers have since come down quite a bit since the policy actions have been undertaken. That has improved the quality of mortgage underwriting.
Senator Wallin: It was essentially in the housing sector?
Mr. Morrow: Yes.
Senator C. Deacon: Thank you, chair. Thank you to the panellists. We all lived through what happened 10 years ago. I remember meeting Andrew Ross Sorkin, who wrote Too Big to Fail. I was amazed by that book and the detail it showed about so many of the errors that were made in flight and preceding the challenges as we got new financial instruments and new things entering into the market that were not being properly managed. I really appreciate the job you do.
I also appreciated hearing you’re working hard to not be satisfied, kind of like a salesperson who, every day at their job, asks, “What have you done for me today?” It doesn’t matter what you did yesterday. You have to keep that ferociousness as you look forward to future risk. I’m thrilled to see it.
My question relates to emerging financial instruments. We talked about derivatives, emerging financial technologies like block chain, for example, and new business models. I think there are exciting business models coming through the fintech space and huge growth in investment in fintechs globally, and that’s a tremendous opportunity.
One of the concerns I had when I was listening to you, and it was a question I asked to an earlier panel, is the balance between innovative and illicit or risky activity. This isn’t all about threats. This is also about opportunity. I think that’s often a tough balance. I really want you to speak a little bit to us about it. I heard Harley Finkelstein speak a year ago when they launched Shopify financial. I thought that was a great instrument for monitoring your cash flow and to give young entrepreneurs using Shopify as a transaction processing platform access to lending based on their income stream. These are phenomenal opportunities.
I see those opportunities as great for us as an economy. I want to hear about how you balance the opportunities against the threats, but also the threat to our big banks when a lot of their high-margin income stream could come under increasing pressure over time as those high-margin items are attacked by competitors that have really great high-value products. The market takes over.
Could you speak a little bit about that end of financial risk and how you see managing it?
Mr. Rudin: I would be glad to start. Perhaps some of my colleagues will want to chime in.
The mandate we have at OSFI is given to us by Parliament. It’s quite clear. On the one hand, in the realm of banking we’re supposed to protect the interests of depositors and other creditors to the banks, but at the same time recognize the importance of allowing banks to compete effectively and take reasonable risks. We are very conscious of the need to balance that mandate.
As a result, we have an approach which I would say is technologically neutral. We have expectations about banks and their ability to manage and mitigate their risks. It’s not hinged on the utilization or non-utilization of any particular technology. During the 30 years OSFI has been in existence, banking has been transformed enormously by technological change.
What we are certainly conscious of is the increasing pace of technological change. We are building up our own capacity to address what we would consider technology risks.
These can arise through partnerships, which are increasingly common with third party providers. That can be a very important way for banks to compete effectively and take reasonable risks. It’s important for banks to understand that using a third party doesn’t relieve them of any of their risk management responsibilities. It can create new types of risk that they need to mitigate whether they be an operational risk, cyber-risk or reputational risk.
As I said, our approach technologically neutral. It’s one that has been compatible with a lot of technological innovation today.
Mr. Morrow: To pick up on the question around innovation, the emergence of crypto-assets in the world. We’ve participated in some work done under the auspices of the FSB taking a look at these new sources of innovation and the risk they pose to the financial system. We are of the view, as the FSB has stated, that at this time, they don’t currently pose a source of systemic risk to the financial system, largely because they are very small part of the financial system at this point.
Nevertheless, in the spirit of vigilance, we also recognize the fact they need to continue to monitor how these innovations progress, how they grow, to make sure they don’t pose a vulnerability to the financial system at some future point.
Ms. Anderson: Building on the comments and to your question about opportunities, I think there is tremendous opportunity with technology and innovation. We’re already seeing results in the sector.
It does present new risks and challenges. We are doing a few initiatives to wrap our hands around that a bit better. For example, in the payment system area, we have the traditional players in that system which are the deposit-taking financial institutions. We see increasingly there are fintech providers in that space.
We launched consultations several years ago to explore the risks and opportunities that they present, and if a framework was required to respond to those risks. There was a lot of good feedback. We came out with a consultation paper and proposals such that for companies not currently regulated, one could envisage a framework that regulated those institutions for the operational and financial risks they present to the system, and also for market conduct risk. We’ve worked very closely with stakeholders on this as well as our provincial partners.
The idea would be to bring greater confidence to the system. The companies themselves welcome that. We’re seeing very good resilience and market conduct by them. To have further reinforcement of our oversight framework that consumers can better see and trust, they feel would be of benefit.
This is an initiative we’re pursuing, and stay tuned, but it is something we think is very important.
The other aspect I would mention is on open banking. We recently announced we would be undertaking a review of the merits of open banking. The government recently announced an expert committee in that space. We will be having a consultation initially on the merits and then, if it is meritorious, implementation considerations. It looks, of course, at the benefits but also the risks. The key ones we need to think carefully about are related to cyber, privacy and whether there are any prudential or safety and soundness risk.
The committee will be meeting with stakeholders across the country on this topic. We are blessed to have leaders in other jurisdictions on this — the U.K. and Australia, for example. We have had some initial discussions and are learning from the experience.
Senator C. Deacon: I’m thrilled to hear that from you, Ms. Anderson. I think the U.K. had a regulatory sandbox that the FCA set up to help these young companies move ahead in a way where they create a lot of opportunities, but also provide yourselves and consumers with the confidence this is a strong venture and albeit innovative, it is not illicit and can be trusted.
Sometimes it may be more expensive oversight. I think often you’ll see investors in those businesses willing to take on that risk. I encourage you to keep pursuing that role. I’m thrilled to hear it. Thank you very much.
Senator Tannas: Some of you may know I have a background in the insurance industry. It won’t surprise you that I want to talk about a catastrophic earthquake as a systemic risk.
Quebec has a situation that’s unique. There’s potential for a catastrophic earthquake there and virtually no one has insurance. Piles of rubble, houses with mortgages and no insurance. I gather the plan of financial institutions is to hope the government will bail it all out.
I would like to focus on the B.C. situation where people do have insurance. Citizens pay for earthquake insurance. There was a report authorized a few years ago, a couple of years ago now, by your predecessor, Nicholas Le Pan, which showed there’s potential that a catastrophic earthquake in British Columbia could wipe out the entire Canadian property and casualty insurance industry and bring contagion to the banks.
He proposed some remedies. There’s still a lot of discussion going on in insurance circles about this.
Mr. Rudin and Ms. Anderson, I wonder if you could comment on how alive you are in your respective shops to this situation. Do you hold concern? Do you see a remedy coming? Or is this something that has perhaps been overblown?
Mr. Rudin: I can begin from an OSFI perspective. We have increased the capital requirements relative to earthquakes. These will phase in over time. They’re designed to make the industry more robust in the event of a catastrophic earthquake. It is motivated by our mandate, relative to insurance, to protect the interests of policyholders and other creditors.
There is a limit to how much capital we’re prepared to require. There will be an earthquake that is even stronger than the one that we require, potentially. I’m not saying it’s going to happen. There’s always the potential the earthquake exceeds the capital requirement. We need to be somewhat restrained in this regard. The more capital required, the more expensive the insurance, the less likely people will purchase it. It doesn’t make sense for us to have capital requirements that ensure the one person who can afford earthquake insurance is sure to get paid.
That does come to the limits of our authorities. We have engaged in discussions. We’re often approached by the industry. We’ve also discussed this with the compensation scheme, PACICC, which has raised this concern, as has the industry. Because there’s an expose funded compensation scheme, if there’s a company that can’t meet its earthquake liabilities, there is a levy on other companies in order to make good on that so this can spread.
However, I have discussed the limit of our current authorities.
Senator Tannas: Which now brings it over to you.
Ms. Anderson: Thank you for mentioning Nick Le Pan’s paper. We’ve all read it. It raises a number of compelling issues for investigation, including the one that Mr. Rudin referenced that is related to the contagion risk through the compensation scheme PACICC. We’re actively looking at those questions. There are not simple answers. We’re doing some analysis with our partners. We’ll be having more focused conversations with the industry on that to better understand the risks and potential mitigation.
Senator Tannas: The problem with this, of course, is procrastination is the most beguiling of solutions.
I understood there was going to be a formal review of this. Is that still on?
Ms. Anderson: That’s correct. We consulted extensively on the review of financial sector statutes. For the most part, responses were that the system was functioning well. There were some areas that merited deeper study due to their complexity. That was one of them. There was a commitment to do that work as well.
Senator Campbell: Thank you very much, chair. Not to put too fine a point on it, but there were three six-plus earthquakes last week in British Columbia. I was here. I didn’t get to feel them on Galiano Island. I was advised they happened.
It may not come as a surprise, being from the lower mainland, that my question has to deal with housing. I’d like to know, have the changes to mortgage lending practices resulted in unexpected consequences for Canada’s housing market? How have these changes effected different regions in Canada?
Mr. Rudin: We recently did a review on the impact of the most recent changes we made which we published on our website. I’ll be happy to provide you a copy.
We’re finding that, to date, the changes we made to the mortgage underwriting guideline are having the impacts we had hoped and expected that they would. Certainly, as Mr. Morrow mentioned, the proportion of mortgage loans made to the most highly indebted consumers is coming down. More broadly, as people get new mortgages, they are now obliged to have a larger margin to be able to accommodate an increase in interest rates on renewal. That will make the system more robust and more stable.
In terms of unintended consequences, one of the potential unintended consequences was that the changes, because they only apply to federally regulated lenders, would push people out of the federally regulated sphere elsewhere. We have not found any evidence of that to date. So far, the federally regulated chair of mortgage origination in the post-policy change environment has been quite stable. It would appear the provincially regulated institutions, who have most but not all of the rest of the market, have either adopted a similar approach on their own or have done so at the suggestion of their own supervisors.
Another potential unintended consequence was, because of the stress test we brought for five-year mortgages is focused on the debt service ratio: how much of the borrower’s income is taken by debt payments. One approach that might have been taken by lenders in order to accommodate this would have been to lengthen the amortization period. Instead of originating a mortgage with a 20-year amortization, originate it with a 30-year amortization that would lower the monthly payment. We have seen very little of that. That doesn’t seem to have happened.
The third unintended consequence that was mooted, and this arises from the mechanics of what we have done, was a highly indebted mortgage holder at renewal may be able to renew with their existing lender but not qualify with another lender because they are, essentially, grandfathered in with their original lender. The concern was raised this would trap the more highly indebted mortgagees with the original lender and the lender would exploit this by charging whatever interest rate they would like. We haven’t found any evidence of this our data. We have a comprehensive view of the interest rate people pay. The difference between the rates offered to new borrowers and renewals doesn’t seem to have changed over the implementation period.
Senator Tkachuk: I am going to ask the same question I asked yesterday on systemic risk: What do you watch for? What do you think is the greatest risk to the financial system? Is it a large international bank failure or a domestic bank failure? Or investment house? Is it a country failure, like another Greece? What gives you the most concern?
Mr. Morrow: One of the main motivations behind our financial system review and the financial system hub, that we will be launching on our website in the coming weeks, is as an outlet for our analysis of where the vulnerabilities are for the Canadian financial system. At this time, we’ve identified household indebtedness and the imbalance in housing markets as the key domestic risk to the Canadian financial system. It is the key area where you could see a potential source of systemic risk. Beyond that, cyber is the other identified key vulnerability that we’ve undertaken. There has been a tremendous amount of resources undertaken by the financial system participants themselves, and by ourselves, looking at this issue and looking to work with them to try to make the system as resilient as it can be.
In terms of other sources of shock, internationally, much of the reforms undertaken were designed to short-circuit the potential for contagion from other countries to spill over into the broad financial system. The identification of globally, systemically important financial institutions. More stringent rules that apply to them have been put in place to try to interrupt the transmission of those shocks elsewhere. Nevertheless, we carefully monitor how the financial system of major jurisdictions are performing, how they are evolving, what the potential sources of risks are there. At this point, the domestic vulnerabilities and cyber would be the key ones we’re paying close attention to.
Mr. Rudin: I certainly agree with that. I think the most pervasive risk to Canadian financial stability is complacency. Complacency in the industry and the risk of complacency in the organizations which are charged with oversight. I take this recommendation to maintain our “ferociousness” very seriously.
We have had a very long run of stability in Canada. It’s easy to take that for granted. It’s our role at OSFI and with our partners to ensure the system is ready to navigate through a wide range of severe yet plausible scenarios, continue to provide financial services to Canadians and continue to enjoy the confidence of the public. Particularly, but not exclusively, with our colleagues at the Bank of Canada we spend that lot of time thinking through where a severe but plausible scenario may arise, what it would look like and how we can get ready for it. We can’t afford to think we will be able to predict and prevent all such events. My own experience says that is impossible. No one has demonstrated that amount of foresight. While we continue to do that, we need to make sure the system is prepared to navigate through events we haven’t foreseen. This is why capital requirements and liquidity requirements are so important, and the ability to, as Mr. Morrow was saying, short-circuit the connections between the troubled institution or a troubled economy and our own are so important.
Senator Tkachuk: I have two further questions. One on cybersecurity. When we talk about banking we focus on the banks themselves, but everyone uses the Internet. We’re all on the same highway and if there is any disturbance on the highway we’re all screwed, I think. Do you pay attention to what would happen if there was a cyber attack on power plants, on infrastructure, that would break all that down. No one in Saskatoon could get on the Internet because there is no power? Do you guys run scenarios? Do you think about those things? Do you discuss that stuff with cyber people?
Ms. Anderson: I would say, as Ron indicated, it’s a key risk in the financial system. When we think about systemic risk it’s about reducing the probability and impact of these risks in order to manage them.
In that vein, we’ve created a number of mechanisms and processes to reduce the overall probability of the event. For example, at the federal level we’ve just launched a new Canadian Centre for Cyber Security on October 1 which provides expertise and guidance on cyber. That’s key. They oversee the critical sectors, so have a line of sight in that space. Supporting that is a new coordination unit for cyber crime. When crimes are seen, we have a good team of folks from the RCMP and elsewhere that deal with those crimes as identified.
Within the financial sector we have dedicated processes and protocols to deal with cyber, depending on the issue at hand. Ron has led some work at the Bank of Canada on protocols in that space related to financial market infrastructures, for example. It’s taking the steps and measures to build the resilience so we reduce the probability of such a risk impacting our sector.
Senator Tkachuk: Just a question on mortgages and interest rates. We’ve had a long period of low interest rates. People have been building homes and getting mortgages at ridiculously low rates. What level would the interest rate have to be for you to start sweating over mortgage and housing?
Mr. Mennill: We have rarely, if ever, seen a large level of mortgage defaults associated with interest rate rises alone. Typically when we’ve had high levels of mortgage defaults, they’re associated with high unemployment, high interest rates, and weak or declining house prices. Typically we will need to see all three of those things combined in order to see a high level of mortgage defaults.
That said, as Mr. Rudin mentioned earlier, the majority of our insured mortgage portfolio has been underwritten with the qualification that the borrower can handle a significant increase in interest rate during the term of that mortgage. We’ve underwritten with a buffer put in place now across the whole industry, not just insured mortgages, that helps ensure We will not experience a high level of default.
Senator Tkachuk: What’s the buffer?
Mr. Mennill: When we underwrite a mortgage, we employ what’s called a “stress test” to that mortgage. It depends whether the mortgage is insured or uninsured. In the uninsured area, I believe there is a 200-basis-point buffer applied to that interest rate. In the insured area, we underwrite using a posted rate that is considerably higher than the rate that the borrowers are paying.
Senator Tkachuk: Some of the things you talk about because of what has been happening in the resource industry in Alberta and Saskatchewan especially. Unemployment is going up, people are losing their jobs, and at the same time, interest rates are bumped a quarter. I don’t see what the Bank of Canada sees. Nonetheless they bumped it up. Are you watching that area? Is it problematic in the mortgage industry right now?
Mr. Mennill: We’re watching very closely. We did see a modest increase in arrears rates about two years ago, following the initial drop in oil prices. That has since moderated. We’ve seen some relative strength in recent months in those markets.
Most of those arrears did not translate into ultimate defaults on the mortgage. Rather those borrowers were able to get themselves back on track.
The Chair: Before we move to a second round, I have a question for you. Yesterday our panel talked to us about systemic risks to the system. They raised with us their concern around what they called shadow banking. Would you want to comment as to whether you would see that as a systemic risk?
Mr. Morrow: The shadow banking sector, or the market-based finance sector, is an area we regularly cover as part of our surveillance of the Canadian and global financial systems. We put out a piece I believe in December of 2016 in our financial system review where we described the shadow banking system in Canada, and presented the view we didn’t believe the shadow banking sector posed large vulnerabilities to the Canadian financial system, mainly because of the limited degree of liquidity and maturity transformation and the generally low level of leverage within the sector. Now, that was at a point in time. It’s a sector we continue to monitor. I wouldn’t say there has been any evolution of the facts since the end of 2016 which would lead us to believe this sector poses a significant source of systemic risk to the Canadian financial system.
Senator Wetston: It’s a very simple question, Mr. Cosman. CDIC insurance, 100,000?
Mr. Cosman: That’s correct, 100,000.
Senator Wetston: They’re around for a while. Any opportunities there to increase that?
Mr. Cosman: 2005 was when the 100,000 came into effect. Recently, through the Department of Finance, there was a deposit insurance review undertaken. Limit was one area that was looked at. The conclusion is the vast majority of Canadians are protected with that limit. It was determined at the time, the time has just been completed, that 100,000 is still the appropriate limit.
Senator Wetston: Is that because they’re not investing, they don’t have deposits? Is it because the standard of living hasn’t increased, their incomes haven’t increased? There is a bit of a missing link there for me on that basis.
Mr. Cosman: There is a significant portion of deposits that aren’t insured. I think it’s 97 per cent of accounts are fully insured. There is a significant amount of dollar value that is not insured. When we think about deposit being there to protect the majority of Canadians, it provides sufficient coverage at $100,000.
Senator Wetston: I see. Thank you.
Senator Tannas: Do you give any thought to the potential of increasing that amount and what it might do for provincial organizations that have full guarantees and have some benefit? Do you factor anything like that into your thinking on $100,000?
Ms. Anderson: I would say, just to build on Dean’s points, we did a comprehensive review of that issue as well as other facets of the deposit insurance system and looked at a lot of data. To Dean’s point, the vast majority of people’s savings is under the $100,000 limit. It seemed to do the trick in terms of covering what we wanted to cover for the objectives we have for CDIC, which is to protect depositors and avoid runs in a crisis scenario. It seemed to be appropriate in the circumstances.
Senator Tannas: Do you think about provincial institutions when you look at that limit at all? Does that come into account, the broader market? Is it just a function of CDIC and banks?
Ms. Anderson: There are different deposit insurance regimes in different provinces. For example, British Columbia has unlimited deposit insurance. We look at it in the context of the depositor base within the federal system —
Senator Tannas: The banks.
Ms. Anderson: — and given the data, it was appropriate to have those protections.
Senator C. Deacon: I’m going to follow up, if I can, on Senator Tkachuk’s comment. I remember reading the PWC report on banking executives’ perspectives on cyber crime and impacts and that 52 per cent of cyber crime likely was going to be the biggest source of fraud and disruption in the system in the next two years. I was shocked that 48 per cent didn’t.
I wonder how you monitor their investment, the types and the amount of investment they make in activities to protect Canadians from the threats that we all know are there, from everywhere in the world. I have to believe a big risk management effort is in how they invest in cybercrime protection in terms of practices, in terms of their own core technology, in terms of their mobile apps, everything they do. How do you monitor that?
Mr. Rudin: We have quite a comprehensive supervisory regime for banks and keep a close eye on a wide variety of their risk-management practices. We have created what we call a diagnostic or self-assessment tool that banks and insurance companies can use to compare what they’re doing on the cybersecurity front to best practices.
This is a sort of a voluntary thing. We don’t require it of all institutions, certainly the smaller ones. But all of the large institutions, and many of the smaller ones, have conducted this self-assessment. When they do that, we ask them to identify the gaps, and what their plans are.
For the large institutions, there’s not really much risk of complacency in this area, despite what I said about complacency being the overriding risk to Canadian financial stability, simply because large institutions are subject to repeated attacks. We’re not talking about trying to bring to their attention something that might happen in the future; we’re talking about something that’s happening every single day.
However, we go out of our way to remind the smaller institutions not to be complacent. There is a risk that smaller institutions think there are richer targets elsewhere, which there are; and there are larger countries to attack, and there are. There are a lot of cybercriminals out there who are prospecting in either a comprehensive or random way. It is important, even for smaller institutions, not to be complacent in this area.
Senator C. Deacon: It occurs to me that it being a voluntary act indicates a level of priority on your part that’s a little lower than I would have expected.
Mr. Rudin: We have been thinking a lot about doing something more prescriptive and more muscular in this area. I don’t hide from the industry that I’d be happy to do that. I feel like I should be doing it. Before we do that, we have to be convinced we’re going to add value, not subtract it. It’s a highly technical and fast-moving area, and having a detailed, prescriptive set of standards is not necessarily going to make the system more secure.
Senator C. Deacon: I’m not suggesting you get standards. I’m just saying the reporting of what investments are making, how they’re investing, the extent to which they’re investing — basically, reporting on how much of a priority this is to them and their organization — I would think would be an indicator. If you see one bank or one financial institution investing, relatively speaking, 10 times the rate of another, you might have a sense of scale that could be an indicator of risk.
Mr. Rudin: We follow this closely with the large institutions. With the smaller institutions, as I said, it’s an ongoing topic of conversation. We don’t currently have a standard against which to assess them. It’s something we continue to think about. As I said, I would be more comfortable if we had one, because I feel that would be a better answer to your question. If we’re going to do that, we have to be convinced that it will not just sound better but actually be better. In this area that’s not yet clear to me.
Mr. Morrow: For the institutions we oversee, the financial market infrastructures, we have developed a set of principles for how they should go about thinking about managing the risk to them.
We have a regular discussion with them in terms of what exactly they are doing in this regard. We’re in the process of establishing, I would say, a kind of target level of maturity for them in this area — not being prescriptive in terms of what they should be doing but being able to demonstrate the level of sophistication broadly they’re taking to manage this risk.
Most importantly, rather than having prescriptive standards, it’s engaging with them to talk about the penetration testing they do with their systems. That’s really the test of how well their protections are working and ensuring we have a good discussion around that. The bank is an institution that itself engages in trying to make sure our systems are up to snuff and regularly engaging in penetration testing. It’s a rich area. You always find things that need to be improved.
Senator C. Deacon: Ever-changing.
Mr. Morrow: It’s a constant investment to try to keep up and make yourself as resilient as you can be.
Mr. Mennill: I might add the perspective of an institution that participates in a commercial manner in the mortgage business. Cyber-risk is our top risk. We have an extensive program, as Mr. Rudin outlined, of identifying potential threats, and a program of mitigating actions we take to minimize those. I can also give you assurance this is taken very seriously throughout the financial sector. Our partners and clients, which are large and small institutions, have similar programs. It’s quite extensive.
The Chair: Thank you all very much. I want to share with you that on Monday this committee will be releasing our report on cybersecurity. We’ve had the opportunity to study this comprehensively for a number of months, and our report — which we hope will be helpful to the dialogue — will be released on Monday.
I also wanted to share with you we will be studying open banking this fall. When we complete this study, we’ll move on to open banking. Hopefully our work in that regard will be complementary to the work you are doing.
Thank you all very much. We’ve had the privilege of having a number of you here with us before. Two or three of you haven’t been with us. I hope the experience was positive. I think we felt it was a positive experience. Thank you all very much, not only for being here today but for the contributions you so clearly make to your organizations.
(The committee adjourned.)